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DETAILED ACTION 



Claims 1 -87 are presented for examination. 

Priority 

No priority claims have been made. 

The effective filing date for the subject matter defined in the pending claims 
in this application is 10/25/2000. 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 



Claims 1-87 rejected under 35 U.S.C. 103(a) as being unpatentable over Ennis, 
Jr. et al. (Patent Number 5,867,483), hereinafter referred to as Ennis, in view of Tarns 
et al. (U.S. Patent Number 6,327,620), hereinafter referred to as Tarns, in view of 
Schaffer (U.S. Patent Number 6,219,050), and further in view of Hernandez et al. (U.S. 
Patent Number 6,208,977), hereinafter referred to as Hernandez. 
Regarding claim 1, Ennis disclosed a method of monitoring a packet-switched 
network using traffic logs (Abstract, Figures 1 and 11), comprising: 
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creating a histogram file (Figures 13-16, column 4 lines 45-64, column 5 lines 13-22); 

i 

generating a traffic log at a first location within the network, the traffic log containing a 
plurality of values detected from data transmission (column 2 lines 16-30, column 7 
lines 22-28, column 8 lines 1 1 -1 6); 

transferring the traffic log from the first location [short term database] to a second 
location [long term database] (Figure 10, column 14 lines 8-33); 

storing the traffic log generated by the network at the second location [long term 
database] (Figure 10, column 2 lines 16-30); 

analyzing the stored traffic log to determine the time of creation of the traffic log and 
the network entry and exit points of the packet (Figures 11, 13-16, column 3 lines 58- 
67, column 4 lines 45-64), 

Ennis taught the invention substantially as claimed. However, Ennis did not 
specifically teach updating the histogram file using at least the time of creation of 
the traffic log and at least one of the entry and exit points of the packet. 
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Ennis suggested exploration of art and/or provided a reason to modify 
the method with the updating feature (column 3 lines 58-64, column 4 lines 45- 
54). 

Tarns disclosed a method of monitoring a packet-switched network using traffic 
logs comprising the step of updating the histogram file using at least the time of 
creation of the traffic log and at least one of the entry and exit points of the packet 
(Figures 8 and 10, column 35-65). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention was made to modify the method of Ennis with the teachings of Tarns to 
include the updating feature in order to appropriately capture data transmission 
system activity (Ennis, column 9 lines 11-15) since network traffic monitoring 
generally being done over the specified time interval (Tarns, column 3 lines 44-45). 

The combination of Ennis and Tarns taught the invention substantially as 
claimed, however, the combination of Ennis and Tarns did not teach the step of 
generating a traffic log at a first location within the network based upon detection of a 
packet, the traffic log containing a plurality of values detected from the packet 
including a network entry point and a network exit point of the packet. 

Tarns suggested exploration of art and/or provided a reason to modify the 
method of Tarns with generating a traffic log where each traffic log contains values 
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such as network entry point and a network exit point of the packet for an individual 
packet (column 5 lines 1-9, column 13 lines 35-42, Table 2). 

Schaffer taught a method of generating a traffic log at a first location within the 
network based upon detection of a packet, the traffic log containing a plurality of 
values detected from the packet including a network entry point and a network exit 
point of the packet (Schaffer, Abstract, column 1 lines 17-35, column 2 lines 24-31, 
column 6 lines 5-27). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention was made to modify the combined method of Ennis and Tarns with the 
teachings of Schaffer to include a step of generating a traffic log where each traffic log 
contains values such as network entry point and a network exit point of the packet for 
an individual packet since for cases where an application's network behavior must be 
understood, the ability of capture and display data associated with an individual 
packet is desired because in multi-tier applications, it is often difficult to understand 
the source and destination of a packet (Schaffer, column 1 lines 54-64, column 2 lines 
10-17). 

Ennis suggested exploration of art and/or provided a reason to modify the 
combined method Ennis, Tarns, and Schaffer with the step of generating billing data 
from the stored traffic logs (column 2 lines 64-column 3 lines 8, column 5 lines 23-40, 
column 24 lines 51 -59). 
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Hernandez disclosed a method for determining billing information for use of a 
network comprising generating billing data for network use at the second location 
using information from the stored traffic logs (Title, Abstract, Figures 1 B, 4A, column 
lines 1-18, column 3 lines 31-67, column 4 line 65-column 5 line 7). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention was made to modify the combined method of Ennis, Tarns, and Schaffer 
with the teachings of Hernandez to include a step of generating billing data for 
network use at the second location using information from the stored traffic logs in 
order to make users accountable for their usage level thereby encouraging more 
efficient use of network resources (Hernandez, column 2 lines 66-column 3 lines 4). 

As the rejection reads, the combination of Ennis, Tarns, Schaffer, and 
Hernandez taught all the limitations as claimed in claim 1 . 

Regarding claim 2, Tarns disclosed a method wherein the histogram file is a 
flat file, whereby direct and rapid access to stored data is effected (column 2 lines 16- 
30). 

Regarding claim 3, Ennis disclosed a method wherein two histogram files are 
created, a first histogram being representative of traffic being passed into the 
network and a second histogram being representative of the traffic being passed 
from the network (column 4 lines 45-59, column 7 lines 23-52). 
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Regarding claim 4, Ennis disclosed a method wherein the histogram file is 
representative of traffic passing to a host connected to the entry or exit point (Figure 
1 , column 7 lines 1 8-40). 

Regarding claim 5, Ennis disclosed a method further comprising repeating 
steps (b) (d) for at least a predetermined period (column 4 lines 45-64, column 15 
lines 31-45). 

Regarding claim 6, Tarns and Schaffer disclosed a method further comprising 
analyzing the traffic log to- determine state information of a packet associated with the 
traffic log, and updating the histogram with the state information (Tarns, column 7 
lines 22-41; Schaffer, Abstract, column 3 lines 23-29). 

Regarding claim 7, Ennis and Tarns combined disclose a method wherein the 
histogram plots packets per minute versus time (Ennis, Figures 11 and 13-16; Tarns, 
column 3 lines 44-52). 

Regarding claim 8, Ennis disclosed a method further comprising 
broadcasting from a server computer data representative of the histogram to a client 
computer (column 15 lines 31-45). Tarns also disclosed this limitation (column 6 
lines 39-45). 

Regarding claim 9, Ennis disclosed a method wherein the network is a packet 
network [Mobitex network] (Title, Abstract). (Note: Mobitex technology is a well-known 
packet data network). 
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Regarding claim 10, Ennis disclosed a method further comprising displaying a 
histogram based on data in the histogram file (Figures 1 1 and 13-16, column 6 lines 
9-37, column 1 7 lines 6-24). 

Regarding claim 1 1 , Ennis and Tarns disclosed a method further comprising 
creating at least one histogram for each host of the network (Ennis, Figures 1 1 and 
13-16, column 17 lines 25-53; Tarns, Tables 1-2). 

Regarding claim 12, Ennis disclosed a method further comprising selecting for 
display the at least one histogram for a particular host (Figures 11 and 13-16, 
column 17 lines 24-53). 

Regarding claim 13, Tarns disclosed a method further comprising monitoring a 
central location of the network for new traffic logs (Figures 5-6 and 8, column 13 
lines 19-42). 

Regarding claim 14, Ennis, Tarns, Schaffer, and Hernandez combined disclose 
a method of monitoring packet traffic through a node of a packet-switched network 
using traffic logs, comprising: 

(a) creating a histogram file for at least one node in the network (Ennis, 
Figures 13-16, column 4 lines 45-64, column 5 lines 13-22); 

(b) generating a traffic log at a first location within the network based upon 
detection of a packet, the traffic log containing a plurality of values detected from 
the packet including a network entry point and a network exit point of the packet 
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(Schaffer, Abstract, column 1 lines 17-35, column 2 lines 24-31, column 6 lines 5- 
27) 

(c) transferring the traffic log from the first location [short term database] to a 
second location [long term database] (Ennis, Figure 10, column 14 lines 8-33); 

(d) storing the traffic log generated by the network at the second location 
[long term databases] (Ennis, Figure 10, column 2 lines 16-30); 

(e) analyzing the stored traffic log to determine the time of creation of the traffic 
log and the network entry and exit points of the packet (Ennis, Figures 11, 13- 
16, column 3 lines 58-67, column 4 lines 45-64). 

(f) determining a network path between the entry and exit points of the packet 
(Ennis, Figures 11, 13-16, column 3 lines 58-67, column 4 lines 45-64, column 7 
lines 43-52); 

(g) determining whether the node falls along the network path (Ennis column 
7 lines 43-52); 



Application/Control Number: 09/695,402 Page 10 

Art Unit: 2143 

(h) updating the histogram file using at least the time of creation of the traffic 
log when the node falls along the network path (Tarns, Figures 8 and 10, 
column 25 lines 50-65; Ennis column 7 lines 43-52, column 8 lines 11-15); and 

(i) generating billing data for network use at the second location using 
information from the stored traffic logs (Hernandez, Title, Abstract, Figures 1 B, 
4A, column lines 1-18, column 3 lines 31-67, column 4 line 65-column 5 line 7). 

Regarding claim 15, Tarns disclosed a method wherein the histogram file is a 
flat file (column 2 lines 16-30). 

Regarding claim 16, Ennis disclosed a method wherein two histogram files are 
created, a first histogram being representative of traffic being passed towards a 
higher level of the network and a second histogram being representative of the traffic 
being passed towards a lower level of the network or outside the network (column 4 
lines 45-59, column 7 lines 23-52). 

Regarding claim 17 ( Ennis disclosed a method further comprising repeating 
steps (b) - (f) for at least a 24-hour period (column 4 lines 45-64, column 15 lines 31- 
45). 

Regarding claim 18, Ennis and Tarns combined disclose a method wherein 
the histogram plots packets per minute versus time (Ennis, Figures 1 1 and 13-16; 
Tarns, column 3 lines 44-52). 

Regarding claim 19, Ennis disclosed further comprising broadcasting, from a 
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server computer, data representative of the histogram to a client computer (column 
15 lines 31-45). Tarns also disclosed this limitation (column 6 lines 39-45)., 

Regarding claim 20, Ennis disclosed wherein the network is a packet network 
[Mobitex network] (Title, Abstract). (Note: Mobitex technology is a wel^known packet 
data network). 

Regarding claim 21, Ennis disclosed further comprising displaying a histogram 
based on data in the histogram file (Figures 11 and 13-16, column 6 lines 9-37, 
column 17 lines 6-24). 

Regarding claim 22, Ennis and Tarns disclosed further comprising creating at 
least one histogram for each node of the network (Ennis, Figures 1 1 and 13-16, column 
1 7 lines 25-53; Tarns, Tables 1 -4A). 

Regarding claim 23, Ennis disclosed further comprising selecting for display the 
at least one histogram for a particular node (Figures 1 1 and 13-16, column 17 lines 24- 
53). 

Regarding claim 24, Tarns disclosed further comprising monitoring a central 
location of the network for new traffic logs (Figures 5-6 and 8, column 13 lines 19-42). 

Regarding claim 25, Ennis, Tarns, Schaffer, and Hernandez combined disclose 
a method of monitoring packet traffic through a link connecting two nodes of a packet- 
switched network using traffic logs, comprising: 

(a) creating a histogram file for at least one link in the network (Ennis, Figures 
13-16, column 4 lines 45-64, column 5 lines 13-22); (b) generating a traffic 
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log at a first location within the network based upon detection of a packet, the 
traffic log containing a plurality of values detected from the packet including a 
network entry point and a network exit point of the packet and a number of 
bytes of the packet (Schaffer, Abstract, Figure 1, column 1 lines 17-35, 
column 2 lines 24-31, column 6 lines 5-27); (c) transferring the traffic log from 
the first location [short term database] to a second location [long term 
database] (Ennis, Figure 10, column 14 lines 8-33); (d) storing the traffic log 
generated by the network (Ennis, Figure 10, column 2 lines 16-30); (e) 
analyzing the traffic log to determine the time of creation of the traffic log and 
the network entry and exit points of the packet(Ennis, Figures 1 1 , 13-16, 
column 3 lines 58-67, column 4 lines 45-64); (f) determining a network path 
between the entry and exit points (Ennis, Figures 11, 13-16, column 3 lines 
58-67, column 4 lines 45-64, column 7 lines 43-52); (g) determining whether 
the link falls along the network path (Ennis column 7 lines 43-52); (h) 
determining a number of bytes carried by the packet associated with the 
traffic log (Shaffer, Figure 1, column 48-54); 

(f) updating the histogram file using at least the time of creation of the traffic log 
when the node falls along the network path and the number of bytes when the 
link falls along the network path (Tarns, Figures 8 and 10, column 25 lines 50-65; 
Ennis column 7 lines 43-52, column 8 lines 11-15); and 
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(g) generating billing data for network use at the second location using 
information from the stored traffic logs (Hernandez, Title, Abstract, Figures 1 B, 
4A, column lines 1-18, column 3 lines 31-67, column 4 line 65-column 5 line 7). 
Regarding claims 26-35, the limitations are closely similar to the limitations of 
claims 15-24, and thus are rejected using the same rationale. 

Regarding claim 36, Ennis, Tarns, and Shaffer combined disclose a method of 
monitoring the operations of a packet-switched network, the network automatically 
generating a traffic log when a packet enters or exits the network by detecting values 
from the packet (Tarns, column 13 lines 35-38; Schaffer, Abstract), the method 
comprising: 

(a) detecting when a new traffic log is available at a network control center 
(Ennis, column 3 lines 41-67; Tarns, Figures 5 and 8); 

(b) downloading the new traffic log to a server computer that maintains a 
plurality of histogram files (Schaffer, Figure 8 sign 1 14, column 8 lines 43-60); 

(c) updating at least one histogram file of the server computer using 
information available from the new traffic log by analyzing the new traffic log to 
determine one or more values detected from the packet that are stored by the 
new traffic log that are relevant to the at least one histogram (Ennis, Figures 8 
and 10, column 35-65; Schaffer, column 8, lines 43-60); 
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(d) deleting the new traffic log (Tarns, column 4 lines 29-43, column 25 lines 
35-49); 

(e) making the updated at least one histogram file available to a client computer 
from the server computer (Ennis, column 15 lines 31-45; Schaffer, column 8 
lines 61 -67); and 



(f) generating billing data for network use at the second location using 
information from the stored traffic logs (Hernandez, Title, Abstract, Figures 1 B, 
4A, column lines 1-18, column 3 lines 31-67, column 4 line 65-column 5 line 7). 

Regarding claims 37-41, the limitations are closely similar to the limitations of 
claims 2-13 & 15-24, thus these claims are rejected using the same rationale. 

Regarding claim 42, Tarns disclosed a method wherein the updating step- 
comprises incrementing a value in the histogram file (column 2 lines 42-59). 

Regarding claim 43, Ennis, Tarns, and Schaffer combined disclose a method of 
analyzing the performance of a packet-switched network, the network automatically 
generating a traffic log, each time a packet exits the network, each traffic log including 
at least the time the traffic log was created, the addresses of the packet sender and 
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packet recipient, and the entry and exit network nodes (Schaffer, Abstract, Figure 1 , 
column 1 lines 13-35, Tarns, Figure 5, column 4 lines 17-24) the method comprising the 
steps of: 

(a) collecting at a centralized location a plurality of traffic logs from the network, 
with each traffic log containing information relevant to a different packet that has 
exited the network (Ennis, Abstract, column 3 lines 41-67, column 4 lines 45-67; 
Tarns, Table 2); 

(b) analyzing each of the plurality of traffic logs to determine information about 
each of the packets that have exited the network (Schaffer, column 1 lines 17- 
35, column 6 lines 5-26); 

(c) automatically generating a plurality of histograms, each histogram being 
based on information gleaned from the plurality of traffic logs about the 
packets that have exited the network; and 

(d) generating billing data for network use at the second location using 
information from the stored traffic logs (Hernandez, Title, Abstract, Figures 1 
B, 4A, column lines 1-18, column 3 lines 31-67, column 4 line 65-column 5 line 
7), wherein at least one histogram is representative of packet traffic passing 
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through a host connected to the network (Ennis, Figures 1 1 and 13-16, column 
4 lines 45-67, column 14 lines 1-33). 

Regarding claims 44-48, the limitations are closely similar to the limitations of 
claims 2-3, 8, 12, and 33. 

Regarding claims 49-59, the system corresponds directly to the method of claims 
1-13, and thus these claims are rejected using the same rationale. , 

Regarding claims 60-68, the. system corresponds directly to the method of 
claims 14-16 & 18-23, and thus these claims are rejected using the same rationale. 

Regarding claims 69-77, the system corresponds directly to the method of claims 
25-27 & 29-34, and thus these claims are rejected using the same rationale. 

Regarding claims 78-83, the system corresponds directly to the method of claims 
36-41 , and thus these claims are rejected using the same rationale. 

Regarding claims 84-87, the system corresponds directly to the method of claims 
43 & 46-47, and thus these claims are rejected using the same rationale. . 
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Since all the limitations of the claimed invention were disclosed by the 
combination of Ennis, Tarns, Schaffer, and Hernandez, claims 1-87 are 
rejected. 



Response to Arguments 

Applicant's arguments filed 11/14/05 have been fully considered but they are not 
persuasive. 

As regard to applicant first argument "the prior do not collect traffic logs for each 
individual packet and do not disclose that such traffic logs created for individual packets 
contain information that is used for generating billing data for use of the network". 
Examiner disagrees, Ennis discloses "the monitoring device identify individual packets 
in the received data stream for copying and storage in packet Ram. Microprocessor 
retrieves packets from the packet Ram and processes the packets to generate 
bandwidth utilization information..." (see Ennis col. 7, lines 22-41, col. 8, lines 32-62). 
The monitoring device of Ennis take individual packets and identify the bandwidth 
utilization in each packet and generate the utilization information, this utilization 
information is equivalent to the traffic logs for each packet. Hernandez discloses 
generating billing information base on the network use (see Hernandez Title and 
abstract). The prior arts Ennis and Tarns in combination of Hernandez would have 
been obvious to a person with ordinary skill in the art to come up with the claim 
invention. 
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As regard to second argument "Hernandez does not disclose generating billing 
data for network use at the second location using information from the stored traffic 
logs". Examiner disagrees, the system of remote monitoring the usage information and 
transferring the monitored information to the central server and stored there for different 
purposes including management, billing etc... The information collected by the 
collecting agents stored as MIB file and transfer to the central server (collector 
subsystem 37). This collector subsystem 37 will generate the billing information base 
on the received information (see Hernandez col.4-col.5). In order for the collector 
subsystem 37 to generate billing data the received information must store somewhere in 
the collector subsystem 37. In addition, Hernandez also discloses that the collector 
subsystem has active memory and drive (see Hernandez Figure 6 and col. 8, lines 49- 
61). 



Conclusion 

THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
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extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 
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Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Duyen M. Doan whose telephone number is (571 ) 272- 
4226. The examiner can normally be reached on 9:30am-6:00pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, David A. Wiley can be reached on (571 ) 272-3923. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 



Duyen Doan 



Examiner 
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